Cisco CCNA (200-301)Security FundamentalsMedium
An administrator must permit only traffic from the 172.16.16.0/21 network in an ACL. Which wildcard mask correctly matches this entire subnet?
- A0.0.0.255
- B0.0.7.255
- C0.0.3.255
- D0.0.15.255
Show answer & explanationAnswer & explanation
Correct answer: B. 0.0.7.255
A /21 mask is 255.255.248.0. Subtracting each octet from 255 gives the wildcard mask: 255-255=0, 255-255=0, 255-248=7, 255-0=255, resulting in 0.0.7.255.
Why the other options are wrong
- A. 0.0.0.255 corresponds to a /24 mask, far too small.
- C. 0.0.3.255 corresponds to a /22 mask, too small a range.
- D. 0.0.15.255 corresponds to a /20 mask, too large a range.
Wildcard Mask Calculation
A wildcard mask is the inverse of a subnet mask, used in ACLs to define which bits must match.
- Wildcard = 255 - subnet mask octet
- /21 = 255.255.248.0 subnet mask
- Wildcard mask 0.0.7.255 matches /21
Memory trick: Wild subtracts from 255 to find the flip side